Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Since we know the XOR key used, we can also translate any other IP’s associated with these domains to presumably<br />
correct C&C IP addresses (see appendix). If we repeat this process with the other XOR key we know of -<br />
0x1AB9C2D8 - we end up with the localhost IP 127.0.0.1 translating to the bogus IP of 167.194.185.27. No<br />
additional data was found at this time using this method, but any DynDNS domain resolving to this IP in the future<br />
might be interesting to look at.